Critical severity · published Aug 31, 2025
CVE-2025-9749
HKritesh009 Grocery List Management Web App update.php sql injection
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was identified in HKritesh009 Grocery List Management Web App up to f491b681eb70d465f445c9a721415c965190f83b. This affects an unknown part of the file /src/update.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Grocery List Management Web App · HKritesh009
f491b681eb70d465f445c9a721415c965190f83b · source: vendor
GL
Grocery List Management Web · Hkritesh009
through 2025-08-23 · source: NVD
Affected product
GL
Grocery List Management Web App
HKritesh009
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9749
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9749
Exploit
https://gist.github.com/0xSebin/a163239e0132d7d58ef1300f321da819
Exploit
https://gist.github.com/0xSebin/a163239e0132d7d58ef1300f321da819#steps-to-reproduce
Permissions Required
https://vuldb.com/?ctiid.322050
Third Party Advisory
https://vuldb.com/?id.322050
Third Party Advisory
https://vuldb.com/?submit.640488